CVE-2025-22226
Published: 04 March 2025
Summary
CVE-2025-22226 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Vmware Esxi. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Escape to Host (T1611); ranked in the top 11.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-7 (Least Functionality).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the out-of-bounds read vulnerability in HGFS by identifying, prioritizing, and applying vendor patches to affected VMware products.
Prevents exploitation by configuring VMware systems to disable unnecessary HGFS shared folder functionality, limiting exposure to malicious VMs.
Detects the presence of the vulnerable HGFS component in VMware ESXi, Workstation, and Fusion through regular vulnerability scanning.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The out-of-bounds read in HGFS allows a VM admin to leak host vmx memory, directly facilitating Escape to Host (T1611), Exploitation for Privilege Escalation (T1068) by crossing VM boundary, and Exploitation for Credential Access (T1212) by exposing sensitive memory data.
NVD Description
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx…
more
process.
Deeper analysisAI
CVE-2025-22226 is an information disclosure vulnerability in VMware ESXi, Workstation, and Fusion, stemming from an out-of-bounds read flaw in the HGFS (Host-Guest File System) component. This issue, classified under CWE-125 (Out-of-bounds Read), carries a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N). It was published on 2025-03-04 and allows potential exposure of sensitive data from the vmx process.
A malicious actor with administrative privileges within a virtual machine can exploit this vulnerability locally. By triggering the out-of-bounds read in HGFS, the attacker can leak memory contents from the host's vmx process, achieving high confidentiality impact across a changed scope without requiring privileges on the host itself, user interaction, or complex conditions.
Mitigation details are outlined in the official Broadcom security advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390. The vulnerability is also listed in the CISA Known Exploited Vulnerabilities Catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-22226, indicating active exploitation in the wild and urging federal agencies to apply patches promptly.
Details
- CWE(s)
- KEV Date Added
- 04 March 2025